US remains the world's dominant power in cyberspace but China is catching up, report says
The United States remains the world's pre-eminent cyber power and is likely to retain that position ahead of China at least until 2030 with the help of similarly advanced Western allies, according to a new report by the International Institute of Strategic Studies (IISS).
Although China has made significant progress bolstering its cyber capabilities since 2014, it has been "nowhere near enough to close the gap" with the US, said Greg Austin, the lead author of the report titled "Cyber Capabilities and National Power: A Net Assessment".
The report, released on Monday, assessed 15 countries' cyber power across seven indicators including core intelligence capabilities, leadership in global cyberspace affairs, security and resilience as well as offensive capabilities.
Do you have questions about the biggest topics and trends from around the world? Get the answers with SCMP Knowledge, our new platform of curated content with explainers, FAQs, analyses and infographics brought to you by our award-winning team.
"The main reason [for US superiority] is the relative standing of the two nations' digital economies, where the US remains far advanced despite China's digital progress," said Austin, a senior fellow with IISS.
Austin noted the US has been building its dominance in cyberspace since the mid-1990s, and its power was amplified by its highly sophisticated intelligence-sharing networks, including with its partners in the Five Eyes alliance.
The US however should not be complacent about its position, he said: "How it grapples with the growing strength of China's digital economy will be decisive for the future balance of cyber power."
The report was compiled based on data from government documents, other open-source material and interviews with experts. The US was the only country in the top tier of the report's ranking, denoting it had "world-leading strengths" in all the metrics.
Seven countries - Australia, Canada, China, France, Israel, Russia and Britain - were in the second tier, indicating they had strengths in some of the assessed categories.
The third tier included countries in earlier stages of development, such as India, Indonesia, Iran, Japan, Malaysia, North Korea and Vietnam.
The report said the studies were conducted against the backdrop of intensifying international confrontation in cyberspace. It cited China's position, outlined in its 2015 military strategy, that outer space and cyberspace had become "new commanding heights" in strategic competition, and how former US president Donald Trump in March 2020 declared a national emergency in cyberspace.
China in March referred to the US as the "champion" of cyberattacks, two months before the foreign ministers of G7 nations urged Beijing and Moscow to observe international norms.
Despite these changes, the US has remained the world's pre-eminent power in cyberspace by investing heavily in civilian and military capabilities as well as the world's strongest digital industrial base, the report said. Its companies are capable of detecting and attributing state cyberattacks and the country has its own sophisticated offensive capabilities.
The report stressed though that the US is more politically and legally constrained than adversaries such as China, Russia, Iran and North Korea.
The report said China's defences remain relatively weak and its resilience policies for critical infrastructure are still in the early stages of development.
Edward Snowden worked at the National Security Agency before revealing the extent of US government surveillance. Photo: AFP alt=Edward Snowden worked at the National Security Agency before revealing the extent of US government surveillance. Photo: AFP
President Xi Jinping instigated a wave of organisational reforms and regulations, including reconfiguring and assuming personal leadership of the main body in charge of cyber policy and establishing a new government body, the Cyberspace Administration of China.
He also launched the "Made in China 2025" industrial policy that sought to make China dominant in global hi-tech manufacturing while reducing its reliance on foreign vendors for core internet technology.
China's cyber intelligence capabilities are formidable domestically, the report said, noting it has the world's most powerful domestic surveillance and censorship system. It has also developed and extensively used its capabilities for overseas espionage but its analysis and dissemination of intelligence is "less mature" than the US and its allies.
"China's influence in the global ICT [information and communication technologies] economy has risen commensurately, including through its development of online platforms," the report said, referring to the growth of companies such as Tencent and Alibaba, which owns the South China Morning Post.
"China is a second-tier cyber power but, given its growing industrial base in digital technology, it is the state best placed to join the US in the first tier."
Even so, the report said China's dependence on foreign vendors for core internet technology remains a "large obstacle". It still relies on US companies including Google, Microsoft, IBM, Oracle and Qualcomm.
China's trajectory could also be slowed by the US decision in 2019 to close its markets to some Chinese digital companies, a partial decoupling that could impede development of more advanced technology.
But China, the report said, has distinct advantages, including its 1 billion internet users and the lower cost of Chinese technology, which make it attractive to developing countries.
China needs to create a cyber-industrial complex on the same scale as the US, the report said. That would mean a more productive relationship between university research, industry and government. China would also need to "radically improve" educational outcomes in cyber-relevant fields, including basic cybersecurity.
"Once these domestic foundations of cyber power equivalence were in place, China would then face a diplomatic challenge," the report said. "To be able to wield its cyber power for global effect, it would have to begin to demonstrate an ability to work in alliance with other cyber-capable states."
Among other countries, Britain and Israel were rated highly on cybersecurity and core intelligence capabilities, as well as their use of offensive capabilities. France also scored well for cybersecurity and intelligence reach.
Other Asian nations lagged behind. For example, even though India has a large digital economy, the report said it has a "complex bureaucracy" that has slowed its advance in cyberspace. Its intelligence and offensive abilities were also focused regionally.
Iran, despite having displayed its offensive capabilities, lacks digital resilience and contingency preparedness due to technological, organisational and economic deficiencies.
Elsewhere, Indonesia has grappled with major threats from cybercrime and cyberterrorism, while Malaysia has yet to develop core intelligence or offensive capabilities, the report said.
Although Japan has a world-class hi-tech industry and is home to many tech firms, its cybersecurity capabilities remain limited. It is also unable to develop offensive capabilities for constitutional reasons. Japan was nevertheless well-placed to move from the third tier to the second tier, the report said.
This article originally appeared on the South China Morning Post (SCMP).
Copyright (c) 2021. South China Morning Post Publishers Ltd. All rights reserved.
